To secure composer credentials you want to remove the auch.

The build phase runson a separate server and variables are not available there you must keep the credentials in the auth. j son file, but you can replace the password with its hash

Add the env:coMPOSER_AUTH variable on the projectlevel and make it visible on the build phase

Putthe composer credentials into/mnt/build/.config/composer/auth.json

Add the composer_auth variable with the sensitive option enabled